Loading…
While this loads — worth knowing
ElastiCache RedisnotElastiCache Memcached
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
Loading…
While this loads — worth knowing
Redis has data structures — sorted sets, counters, pub/sub. Memcached has plain keys and nothing else.
A record of the actions taken in your AWS account by people, roles and services: who did what, to which resource, when and from where.
Where CloudTrail takes you5 steps, all open
CloudTrail records the actions taken by users, roles and AWS services in your account as events, whether they came from the console, the CLI, an SDK or the API. Each event says who acted, on which resource, when and from where.
Three ways to keep them. Event history shows the last 90 days of management events in each Region, free and there from the day the account is created. A trail delivers events to an S3 bucket, where they stay as long as you keep them. CloudTrail Lake stores them for SQL queries, but it stopped taking new customers on 31 May 2026.
The visitor log at a building's front desk. Every door opened and every key card used is written down with the person, the time and the door. The desk keeps the last 90 days on its own shelf; for longer, pages are sent to a vault, sealed so anyone can tell if one was changed or torn out.
EventEvent historyTrailManagement eventsData eventsLog file validationWas it a management event, recorded by default, or a data event, such as reading an S3 object, recorded only where a trail was told to?
Is it within 90 days, which event history covers, or older, which needs a trail's copies in S3?
Event history is per Region; a multi-Region trail puts every enabled Region in one bucket.
With log file validation on, digest files show whether a log file was changed or deleted after delivery.
Pick a case to follow the question through each check.
One trail for the whole organization. An organization trail, created from the management account or a delegated administrator, logs every member account to the same bucket, and the members cannot change or delete it.
Keep and protect the files. S3 Lifecycle rules decide how long log files stay; a trail made in the console encrypts them with a KMS key; validation shows whether any was altered.
Alarms on activity. Delivered to CloudWatch Logs, events can be counted by a metric filter, and an alarm can tell the security team when a particular call is made.
Query where they lie. Athena can search the log files in the bucket with SQL.
Log file validation hashes every log file with SHA-256 and signs an hourly digest file with RSA, so changing, deleting or forging a file cannot go unnoticed.
Encryption. A trail created in the console encrypts log and digest files with a KMS key; without SSE-KMS they are encrypted with S3 server-side encryption.
Organization trails are visible to member accounts, which cannot turn them off, change what they log, or delete them.
Global services. Events from IAM, AWS STS and CloudFront are recorded in US East (N. Virginia); a multi-Region trail captures them along with everything else.
Event history is free, and so is the first copy of management events that a trail delivers to S3; you pay S3 for storing it.
Additional copies of management events are charged.
Data events and network activity events are charged by the number delivered.
Insights is charged by the events it analyses.
CloudTrail Lake charges for ingesting data, keeping it, and the data each query scans.
Prices change, so none are printed here. Check the CloudTrail pricing page on aws.amazon.com.
| Where | Holds | For how long | Choose it when |
|---|---|---|---|
| Event history | Management events, one Region at a time | 90 days | A quick look back, at no charge |
| Trail | The events you select, from every Region | As long as the bucket keeps them | A lasting record, alarms and analysis |
| CloudTrail Lake | Events in a store you query with SQL | Up to 3,653 days | SQL across accounts, if you already use it |
| Event type | For example | Logged by default |
|---|---|---|
| Management | Creating a subnet, attaching a policy, signing in to the console | Yes |
| Data | GetObject and PutObject on S3 objects, invoking a Lambda function | No |
| Insights | Unusual rates of API calls or errors | No |
| Service | Answers |
|---|---|
| CloudTrail | Who did what in the account, when and from where |
| CloudWatch | How resources and applications are behaving |
who terminated the instance last weekCloudTrail event history
Ninety days of management events, free, in the Region where it happened.
keep a record of API activity for 7 yearsA trail to S3
Event history stops at 90 days.
who downloaded objects from a bucketS3 data events on a trail
Data events are not logged by default.
prove the audit logs were not tampered withLog file integrity validation
SHA-256 hashes and signed hourly digest files.
one trail for every account in the organizationAn organization trail
Members can see it, but not change or delete it.
record activity in every Region, not only the one in useA multi-Region trail
It covers every enabled Region, and the console creates trails that way.
alert the moment a particular API call is madeTrail to CloudWatch Logs, a metric filter and an alarm
CloudTrail itself raises no alarms.
spot an unusual burst of API callsCloudTrail Insights
It compares call and error rates with the account's normal pattern.
audit events must arrive within seconds of the callNot guaranteed
Log files arrive about every 5 minutes on average.
run SQL over CloudTrail logs in S3Athena
It can search the trail's log files where they are stored.
A bank must keep a record of every API call in all Regions of its 30 AWS accounts for seven years, be able to detect whether any log file has been altered, and stop the administrators of each account from turning the logging off. What should a solutions architect do?
Auditors need a record of every API call made in the account, kept in S3 for years and queried with SQL whenever they ask. What produces the record that lands in the bucket?
90 days of management events, free, per Region.5 minutes, not guaranteed.This whole page is free right now.The AWS library is still being written, so every page of it is open to everyone while that lasts. It becomes a paid bundle later; what you read today costs you nothing.
Every fact on this page was checked against AWS’s own documentation on 15 Sept 2026. If AWS has changed something since, its page is the one to trust.